{"id":36242,"date":"2014-06-26T16:19:54","date_gmt":"2014-06-26T23:19:54","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=36242"},"modified":"2025-08-07T22:27:22","modified_gmt":"2025-08-08T05:27:22","slug":"android-personal-unlocking","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/android-personal-unlocking\/","title":{"rendered":"Google Just Made Unlocking Your Phone Easier. But is that Good or Bad?"},"content":{"rendered":"

It\u2019s the last week in June and the sun is shining and the birds are chirping and the dogs are barking in the field. That is, of course, unless you live in San Francisco where the fog is rolling in like a cold, damp quilted blanket. In a concerted effort to dodge the seasonal gloom, the best and brightest developers are gathering at Google\u2019s annual I\/O conference<\/a>.<\/p>\n

At the conference, Google announced the next iteration of Android, called \u201cAndroid L,\u201d and it appears to be their first concentrated effort to bring both wearable computing and the Internet of Things<\/a>\u2014where everyday devices are connected to each other and to the Internet for analysis and optimization\u2014under one manageable roof. It\u2019s a logical move to make the experience across their many products and services as fluid and comfortable as possible. But fluidity isn\u2019t always what\u2019s best for security.<\/p>\n

Buried in Google\u2019s many Android-centric announcements is a new feature called \u201cpersonal unlocking<\/a>.\u201d It enables wearable devices, such as Google\u2019s new smartwatch, to unlock your Android device with the wave of a wrist, eliminating the need to enter a cumbersome PIN code. In a nutshell, if you\u2019re wearing the watch, access to the phone is yours. The magic is done over a Bluetooth connection\u2014a wireless standard for exchanging data over short distances\u2014and is a nifty solution to the two-factor authentication<\/a> problem (two-factor authentication is a security standard where you possess an object\u2014like a smartphone, smartwatch or key fob\u2014and possess some special knowledge\u2014like a passcode, passphrase or a PIN number).<\/p>\n

Additionally, the new \u201cpersonal unlocking\u201d feature will recognize your home Wi-Fi network and allow for you to skip the PIN code while you\u2019re in the comfort of your home.<\/p>\n

Sounds great in theory, but Google\u2019s \u201cpersonal unlocking\u201d feature poses a problem to your security: it removes one of the factors in the two-factor authentication standard. By forgoing the PIN code in favor of a Bluetooth connection or Wi-Fi network, Google is removing the special knowledge aspect of two-factor authentication. That means all hackers have to do is spoof the right Bluetooth connection or hack into your Wi-Fi to gain access to your mobile device.<\/p>\n

Now, it could be that Google simply forgot to mention that users can still request a PIN code challenge with personal unlock enabled, but we won\u2019t know for some time. After all, the search engine giant has only just announced its latest Android iteration. Developers and hackers alike will need some time to poke holes and create patches for Android L before we can be certain of the new operating system\u2019s security shortcomings (and its strengths).<\/p>\n

Still, spoofing a Bluetooth or Wi-Fi connection and stealing a smartphone to gain access to information isn\u2019t outside the realm of possibility. While personal unlocking is a nice feature, most users will need additional security to lock down their phone.<\/p>\n

Options to Lockdown Your Device<\/h2>\n

So what can you do to lockdown your device? Well there are a few options available:<\/p>\n